How do I answer a “compare firewall and IDS” question in IB Computer Science?

Start with one-sentence definitions for both tools, using the words prevention and detection early. Then describe the mechanism: a firewall enforces rules on incoming/outgoing traffic, while an IDS monitors and alerts based on suspicious patterns. Add one limitation for each to show evaluation (for example, firewalls struggle with insider threats; IDS can generate false positives). Finally, tie them together using the phrase defence in depth. This structure reads like a markscheme because it separates function, method, and evaluation clearly.

Does an IDS block attacks automatically in IB Computer Science?

In most IB Computer Science contexts, the expected answer is no: an IDS primarily detects and alerts. That distinction matters because it is the cleanest comparison against a firewall, which actively blocks traffic. If a question describes automatic blocking, it is often pointing you toward an IPS, not an IDS. Mentioning this shows careful reading of the scenario, which is exactly what the best responses do. If you are unsure, look for command terms like “monitor,” “alert,” or “log” (IDS) versus “prevent,” “stop,” or “block” (firewall/IPS).

What is a realistic example scenario that uses both tools?

Imagine a school network that allows web traffic but blocks unknown inbound connections. The firewall enforces that boundary by allowing only approved services and blocking suspicious ports. Meanwhile, an IDS watches internal traffic patterns and triggers an alert when a device suddenly starts scanning many IP addresses or sending unusual volumes of data. In IB Computer Science, you can frame this as: firewall reduces the attack surface; IDS provides visibility into attempted bypasses or internal compromise. Adding one sentence about human response (admin investigates the alert) makes it feel authentic and earns method marks.

IB Computer Science: Firewalls vs IDS (Exam-Friendly)

IB Computer Science

RevisionDojo Team

•12/27/2025•6 min read

This site uses cookie tracking technologies. Learn more in our Cookie Policy.

IB Computer Science: Firewalls vs IDS (Exam-Friendly)

IB Computer Science

RevisionDojo Team

•12/27/2025•6 min read

If you have ever watched a school network block a website instantly, it feels like magic. But real security is rarely one spell. In IB Computer Science, exam questions about network security quietly test something deeper: can you explain prevention vs detection with calm precision when the scenario gets messy?

This post breaks down firewalls vs intrusion detection systems (IDS) in a way that maps directly to how IB Computer Science markschemes reward comparisons.

Quick checklist for IB Computer Science answers

Use this mini-structure whenever a question asks you to compare tools:

Define each tool in one sentence.
State the core role: firewall = prevention, IDS = detection.
Describe how it works at a high level (rules vs monitoring/signatures/anomalies).
Give one limitation for each.
Finish with why they are better together (defence in depth).

To tighten your terminology, keep the IB Computer Science Key Definitions open while you practise.

What a firewall does (prevention)

A firewall controls traffic that tries to enter or leave a network. In IB Computer Science, the clean phrase is that a firewall is a barrier between trusted and untrusted networks.

Firewalls work by applying predefined rules to network traffic. Conceptually, they inspect packets (like checking the envelope) and decide whether to allow, block, or log the connection attempt.

If you want the deeper syllabus-aligned version, see Effectiveness of Firewalls at Protecting a Network (A2.4.1) and the companion explainer Firewalls Explained: Hardware vs Software.

When a firewall is the best fit

In exam scenarios, choose a firewall when the goal is to:

block unauthorised access before it reaches internal devices
restrict services/ports (reduce attack surface)
enforce access control at the network boundary

What an IDS does (detection)

An Intrusion Detection System (IDS) monitors network or system activity and generates alerts when behaviour looks suspicious. The key IB-friendly line: an IDS typically does not block traffic automatically.

An IDS may detect threats by:

signature-based detection (matching known attack patterns)
anomaly-based detection (spotting unusual behaviour compared to a baseline)

So in IB Computer Science, IDS is about visibility and evidence: it helps you notice what slipped through, what came from inside, or what looks abnormal.

Firewalls vs IDS in one comparison (what examiners want)

Here is the comparison that tends to earn marks fast in IB Computer Science:

Firewall: prevents unauthorised traffic by enforcing rules and blocking connections.
IDS: detects suspicious activity by monitoring and analysing behaviour, then raises alerts.

If you accidentally swap them (writing that IDS blocks everything, or that firewalls “detect” attacks), you lose the easy marks.

To practise with examiner-style prompts, use A2.4 Network Security Questionbank.

Why both are used together (defence in depth)

A firewall reduces the number of threats that can even attempt access. An IDS watches for what still happens anyway: misconfigurations, sophisticated attacks, or suspicious internal activity.

This layered approach is the story of modern security, and it is also the story examiners like: no single tool is enough.

If you want the “next step” beyond IDS, read Intrusion Prevention Systems (IPS) Explained (IPS = detection plus automatic blocking).

Limitations you can mention (easy evaluation marks)

Firewall limitations (pick one or two):

cannot easily detect insider threats
may not detect all attacks (especially if traffic is allowed but malicious)
limited visibility into encrypted content unless combined with other tools

IDS limitations (pick one or two):

alerts require human response (or another system) to act
false positives can waste time
may miss novel attacks depending on detection method

Closing: the simplest way to remember it

In IB Computer Science, treat this like a two-part sentence:

A firewall tries to stop the problem at the door. An IDS tries to notice the problem when it is already knocking (or already inside).

If you want to turn that understanding into exam points, use RevisionDojo to practise it repeatedly: build timed sets in the Questionbank, tighten wording with Study Notes and Flashcards, ask AI Chat to critique your comparisons, and validate your explanations with Grading tools, Mock Exams, and Predicted Papers. When the exam asks “firewalls vs IDS,” you will not just know it -- you will be able to write it.

This site uses cookie tracking technologies. Learn more in our Cookie Policy.

IB Computer Science: Firewalls vs IDS… | RevisionDojo

This post breaks down firewalls vs intrusion detection systems (IDS) in a way that maps directly to how IB Computer Science markschemes reward comparisons.